SOC Analyst / Threat Hunter

About the Job

ServCrust is seeking a skilled SOC Analyst / Threat Hunter (L2) to join our team in Hyderabad, Telangana, India. This full-time, onsite position is crucial for enhancing our security operations across both on-premise and AWS environments.

In this role, you will be responsible for investigating security alerts, proactively hunting for threats, supporting incident response activities, and contributing to the improvement of our detection capabilities. Your efforts will be vital in maintaining the security and reliability of our platform.

Key Responsibilities

• Triage and investigate security alerts originating from SIEM, EDR, NDR, and CSPM tools.
• Correlate logs from endpoints, networks, and AWS cloud services to identify suspicious activities.
• Investigate instances of IAM misuse, unusual API calls, privilege escalation, and exposed storage.
• Support containment actions, including isolating workloads, revoking credentials, and suspending IAM users.
• Perform root cause analysis for both cloud and on-premise security incidents.
• Validate and ensure comprehensive security tool coverage (CSPM/CIEM) across all environments.
• Contribute to post-incident reviews and update existing playbooks.
• Conduct proactive threat hunting exercises across cloud and on-premise logs.
• Apply MITRE ATT&CK (Cloud) techniques to identify and understand threat behaviors.
• Improve and fine-tune detection rules and monitoring logic for enhanced security posture.
• Recommend opportunities for automation within incident response workflows.

Required Qualifications

• 2-4 years of experience in a Security Operations Center (SOC), Incident Response (IR), or security monitoring role.
• Hands-on experience with log analysis and investigation within cloud platforms, specifically AWS (including CloudWatch, CloudTrail, GuardDuty).
• A solid understanding of attacker tactics, techniques, and procedures (TTPs) within cloud environments, such as exposed credentials, over-permissioned roles, container abuse, and cloud lateral movement.
• Proficiency with SIEM/EDR platforms and standard investigation workflows.
• Basic scripting or automation knowledge using languages like Python, PowerShell, or Boto3.
• Familiarity with cloud-native security tools, such as AWS Config.
• Relevant certifications, such as CySA+ or AWS Security Specialty, are considered desirable.

If you are interested in this opportunity, please send your resume to recruitment@servcrust.com.

Visit our website at www.servcrust.com to learn more.

#Hiring #SOCAnalyst #ThreatHunter #CyberSecurityJobs #CloudSecurity #AWS #SecurityAnalyst #SIEM #EDR #NDR #InfoSec #HyderabadJobs #OnsiteJobs #TechJobs #ServCrust #Hyderabad #SecurityOperations #JobSearch #NowHiring